A proper implementation of more versatile server filters are on my withlist since a long time. Your patch is a step it the right direction but it's still not powerful enough IMO. Support for comparative operators (<,>,==,...) would be highly useful for example. But then you also want bit operators (&,|,>>,<<,...) e.g. for matching dmflags bits.

Wrt implementation itself. You should separate terms with '&&' instead of '||' because '&&' means 'and' and you also actually link them as 'and' internally. That allows to implement 'or' as well sometime. Also you use g_strsplit in a loop ie malloc and free. That's inefficient and slow, you need to already parse the expression into a form that can quickly be processed by the machine when you read the config file.

btw I prefer to discuss patches on the mailinglist. The sf interface just plain sucks. Please subscribe to the devel list if I didn't already scare you away and you are still interested in xqf development.